July 9th - 2007

Employee’s indiscretion results in complaint to Privacy Commissioner

A recent decision of the Office of the Privacy Commissioner (OPC) shows how an employee’s “slip of the tongue” during a relatively routine telephone call about debt collection resulted in her employer getting into trouble with the Privacy Commissioner.

A recent decision of the Office of the Privacy Commissioner (OPC) shows how an employee’s “slip of the tongue” during a relatively routine telephone call about debt collection resulted in her employer getting into trouble with the Privacy Commissioner.
 
The full PIPEDA Case Summary #371 can be found on the OPC’s web site.
 
The case involved a couple (the complainants), their former building contractor and the building supply store about which the complaint was made. The couple had a line of credit with the store, and both they and their contractor bought building supplies from the store. The couple and their contractor became involved in a dispute, which wound up in Small Claims Court.
 
During the court proceeding, the building contractor stated that the building supply store had divulged to him information about the couple’s credit account. According to the complainants, the information he was referring to was their credit information and balance owing.
 
They contacted the general manager of the store who said that he would investigate the matter and advise the complainants of the outcome, but they did not receive a response.
 
During the OPC’s investigation, the store management claimed that no account information had been disclosed to the contractor. According to the company, only three employees would have had access to the couple’s financial information: the comptroller, the general manager, and the customer accounts employee.
 
When the OPC spoke to the customer accounts employee, she said that she had spoken to the contractor to determine whether he had been paid by the couple and that she had told him that the couple owed money on their account with the store.
 
She stated that, at one time, it had been common practice for the store to meet with other suppliers and openly discuss outstanding accounts that the businesses had with common customers. She added, however, that the store no longer has such discussions. She also pointed out that the couple had signed a credit application form containing a statement about the collection and disclosure of their credit information.
 
In the store’s view, the complainants had given their consent to the collection and disclosure of their credit information, based on the following consent language found in the application:

The undersigned consents to the obtaining of credit and/or personal information as may be required in connection with the credit hereby applied for or any renewal or extension thereof and to the disclosure of any credit information concerning the undersigned to and (sic) credit reporting agency or to any person with whom the undersigned has or proposes to have financial relations.

The Assistant Privacy Commissioner did not agree with the store’s view and found as follows:

The building supply store did disclose information about the couple’s account to the contractor, since the customer accounts employee said she had told the contractor they owed money to the store.
 
The employee made the disclosure not for the purpose of collecting debt but in order to obtain information about the couples’ general financial situation. Therefore, the disclosure did not fall under one of the PIPEDA exemptions to consent (paragraph 7(3)(b)), which states that an organization may disclose personal information without knowledge or consent for the purpose of collecting a debt owed by the individual to the organization.
 
The building supply store did not have the complainants’ consent to disclose their personal information to the contractor, since the wording of the consent clause was vague and failed to inform them of the purpose for collecting, using and disclosing their personal information.

Keep information private

A similar example of an employee’s informal disclosure causing the employer to deal with the Privacy Commissioner can be found at http://www.privcom.gc.ca/cf-dc/2005/298_050317_03_e.asp. In that case, the complainant left her unlisted telephone number with a pet store employee, in case any kittens became available. Shortly afterwards, she starting receiving numerous phone calls from a former friend. As it turned out, the pet store employee had disclosed the complainant's telephone number to the former friend in the hopes of reuniting the two of them. Again, the complaint was held to be well-founded by the Assistant Privacy Commissioner.
 
BE AWARE: While businesses must always be concerned about security issues and identity theft and making sure that they comply with their privacy policies, sometimes it can be the smallest, most casual of disclosures that can land them into trouble. Organizations need to ensure that their employees do not have a mistaken understanding of what they can do regarding a customer’s personal information. One way to do this is to provide effective employee training and, of course, to make sure that proper consents are in place regarding the use and disclosure of personal information.

Share this item

Merv’s Column: What constitutes “nuisance”? Check hydro pole ownership in rural areas

For more information contact

Ontario Real Estate Association

Jean-Adrien Delicano

Manager, Media Relations

JeanAdrienD@orea.com

416-445-9910 ext. 246

Ontario Real Estate Association
Facebook LinkedIn YouTube Instagram

The trademarks REALTOR®, REALTORS®, and the REALTOR® logo are controlled by The Canadian Real Estate Association (CREA) and identify real estate professionals who are members of CREA. The trademarks MLS®, Multiple Listing Service® and the associated logos are owned by The Canadian Real Estate Association (CREA) and identify the quality of services provided by real estate professionals who are members of CREA. Used under license.

OREA AI Assistant